yuce / pyopenbsd

Python wrapper for some OpenBSD-specific APIs

openbsd

Python bindings for some OpenBSD-specific APIs. Currently the following are supported:

• pledge
• unveil

Change Log

v0.1.0 (2019-05-03)

* Initial release.

Installation

Openbsd is on PyPI. You can install it using pip:

pip install openbsd

Prerequisites

• OpenBSD 6.4 or better
• Python 3.6 or better OR Python 2.7

Usage

Import openbsd first:

import openbsd

pledge

See: https://man.openbsd.org/pledge.2

openbsd.pledge("stdio rpath")
print(open("/etc/resolv.conf"))

Try removing the`rpath permission.

unveil

See: https://man.openbsd.org/unveil.2

openbsd.unveil("/etc", "r")
print(open("/etc/resolv.conf"))

Try opening /bin/ksh.

Use openbsd.unveil() to lock down restrictions.

Similar Projects

• PyPledge: Python binding for the OpenBSD pledge(2) system call. Uses ctypes.

License

(c) 2019 Yuce Tekol

BSD

pyopenbsd's Issues

pledge('', '') always gets the process killed

I started to add tests in my fork, and I found that a process calling pledge('', '') always gets killed.

$ python3.8 -c "import openbsd; openbsd.pledge('', '')"
Abort trap (core dumped)

I thought that python might be calling some forbidden syscall at the end of the program, so I tried with os._exit:

$ python3.8 -c "import os; import openbsd; openbsd.pledge('', ''); os._exit(0)"
Abort trap (core dumped)

Same issue. On the manual of pledge(2), it is said that _exit(2) is allowed.

A promises value of "" restricts the process to the _exit(2) system call. This can be used for pure computation operating on memory shared with another process.